187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

Analysis

max time kernel
84s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
Size

1016KB
MD5

536bf34ae912efa69399ae0615e7f450
SHA1

3ba338a4be5324c58909fc7277c695c24a72f71b
SHA256

187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b
SHA512

95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b
SSDEEP

6144:sIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:sIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xhlucgp.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xhlucgp.exe

Adds policy Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "khyupgcqmisedcftewgd.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxpmiaxmjgreeeixjcnld.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "mhwqjyseysakhefraq.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "mhwqjyseysakhefraq.exe"	xhlucgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "wpculyqaskqytonx.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpculyqaskqytonx.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "khyupgcqmisedcftewgd.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "dxlewkdohahqmiitb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rfnamuhmzmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxpmiaxmjgreeeixjcnld.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "khyupgcqmisedcftewgd.exe"	xhlucgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofqgvgweukoung = "wpculyqaskqytonx.exe"	xhlucgp.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xhlucgp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xhlucgp.exe

Executes dropped EXE 3 IoCs

pid	Process
4952	hkaqkpraruk.exe
4460	xhlucgp.exe
2396	xhlucgp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hkaqkpraruk.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	xhlucgp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "dxlewkdohahqmiitb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "wpculyqaskqytonx.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhwqjyseysakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxpmiaxmjgreeeixjcnld.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "wpculyqaskqytonx.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpculyqaskqytonx.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe ."	hkaqkpraruk.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhwqjyseysakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhwqjyseysakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "khyupgcqmisedcftewgd.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "zxpmiaxmjgreeeixjcnld.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhwqjyseysakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "zxpmiaxmjgreeeixjcnld.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "dxlewkdohahqmiitb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxpmiaxmjgreeeixjcnld.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "mhwqjyseysakhefraq.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpculyqaskqytonx.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "xtjeyojwrmvgecerbsb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "dxlewkdohahqmiitb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "xtjeyojwrmvgecerbsb.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "dxlewkdohahqmiitb.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxlewkdohahqmiitb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "mhwqjyseysakhefraq.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhwqjyseysakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpculyqaskqytonx.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtjeyojwrmvgecerbsb.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "dxlewkdohahqmiitb.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxpmiaxmjgreeeixjcnld.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpculyqaskqytonx.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "zxpmiaxmjgreeeixjcnld.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyupgcqmisedcftewgd.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxlewkdohahqmiitb.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhwqjyseysakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhwqjyseysakhefraq.exe"	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "khyupgcqmisedcftewgd.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\odmanwkqesuy = "wpculyqaskqytonx.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "zxpmiaxmjgreeeixjcnld.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wpculyqaskqytonx = "mhwqjyseysakhefraq.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dxlewkdohahqmiitb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxlewkdohahqmiitb.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndncqapwladia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxpmiaxmjgreeeixjcnld.exe ."	xhlucgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rjvmcofofwbicwu = "zxpmiaxmjgreeeixjcnld.exe"	xhlucgp.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xhlucgp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xhlucgp.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	www.showmyipaddress.com
30	whatismyip.everdot.org
45	whatismyipaddress.com
52	www.showmyipaddress.com
55	whatismyip.everdot.org
22	whatismyip.everdot.org
25	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wpculyqaskqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\dxlewkdohahqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\xtjeyojwrmvgecerbsb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\zxpmiaxmjgreeeixjcnld.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\qpigdwukigsghindqkwvom.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\mhwqjyseysakhefraq.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\khyupgcqmisedcftewgd.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\dxlewkdohahqmiitb.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\xtjeyojwrmvgecerbsb.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\zxpmiaxmjgreeeixjcnld.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\dxlewkdohahqmiitb.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\qpigdwukigsghindqkwvom.exe	xhlucgp.exe
File created	C:\Windows\SysWOW64\ejimpososwoipwhdwwotswzy.ycg	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\ndncqapwladiasovzkndncqapwladiasovz.ndn	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\wpculyqaskqytonx.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\khyupgcqmisedcftewgd.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\wpculyqaskqytonx.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\xtjeyojwrmvgecerbsb.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\zxpmiaxmjgreeeixjcnld.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\ejimpososwoipwhdwwotswzy.ycg	xhlucgp.exe
File created	C:\Windows\SysWOW64\ndncqapwladiasovzkndncqapwladiasovz.ndn	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\mhwqjyseysakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\mhwqjyseysakhefraq.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\qpigdwukigsghindqkwvom.exe	xhlucgp.exe
File opened for modification	C:\Windows\SysWOW64\khyupgcqmisedcftewgd.exe	xhlucgp.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ejimpososwoipwhdwwotswzy.ycg	xhlucgp.exe
File created	C:\Program Files (x86)\ejimpososwoipwhdwwotswzy.ycg	xhlucgp.exe
File opened for modification	C:\Program Files (x86)\ndncqapwladiasovzkndncqapwladiasovz.ndn	xhlucgp.exe
File created	C:\Program Files (x86)\ndncqapwladiasovzkndncqapwladiasovz.ndn	xhlucgp.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\qpigdwukigsghindqkwvom.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\qpigdwukigsghindqkwvom.exe	xhlucgp.exe
File opened for modification	C:\Windows\dxlewkdohahqmiitb.exe	xhlucgp.exe
File opened for modification	C:\Windows\mhwqjyseysakhefraq.exe	xhlucgp.exe
File created	C:\Windows\ejimpososwoipwhdwwotswzy.ycg	xhlucgp.exe
File opened for modification	C:\Windows\xtjeyojwrmvgecerbsb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\dxlewkdohahqmiitb.exe	xhlucgp.exe
File opened for modification	C:\Windows\wpculyqaskqytonx.exe	xhlucgp.exe
File opened for modification	C:\Windows\zxpmiaxmjgreeeixjcnld.exe	xhlucgp.exe
File opened for modification	C:\Windows\qpigdwukigsghindqkwvom.exe	xhlucgp.exe
File opened for modification	C:\Windows\ejimpososwoipwhdwwotswzy.ycg	xhlucgp.exe
File opened for modification	C:\Windows\ndncqapwladiasovzkndncqapwladiasovz.ndn	xhlucgp.exe
File opened for modification	C:\Windows\khyupgcqmisedcftewgd.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\zxpmiaxmjgreeeixjcnld.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\wpculyqaskqytonx.exe	xhlucgp.exe
File opened for modification	C:\Windows\mhwqjyseysakhefraq.exe	xhlucgp.exe
File opened for modification	C:\Windows\xtjeyojwrmvgecerbsb.exe	xhlucgp.exe
File opened for modification	C:\Windows\khyupgcqmisedcftewgd.exe	xhlucgp.exe
File opened for modification	C:\Windows\xtjeyojwrmvgecerbsb.exe	xhlucgp.exe
File opened for modification	C:\Windows\khyupgcqmisedcftewgd.exe	xhlucgp.exe
File created	C:\Windows\ndncqapwladiasovzkndncqapwladiasovz.ndn	xhlucgp.exe
File opened for modification	C:\Windows\wpculyqaskqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\dxlewkdohahqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\mhwqjyseysakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\zxpmiaxmjgreeeixjcnld.exe	xhlucgp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
4460	xhlucgp.exe
4460	xhlucgp.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
4460	xhlucgp.exe
4460	xhlucgp.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	xhlucgp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 4952	932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe	81
PID 932 wrote to memory of 4952	932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe	81
PID 932 wrote to memory of 4952	932	187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe	81
PID 4952 wrote to memory of 4460	4952	hkaqkpraruk.exe	82
PID 4952 wrote to memory of 4460	4952	hkaqkpraruk.exe	82
PID 4952 wrote to memory of 4460	4952	hkaqkpraruk.exe	82
PID 4952 wrote to memory of 2396	4952	hkaqkpraruk.exe	83
PID 4952 wrote to memory of 2396	4952	hkaqkpraruk.exe	83
PID 4952 wrote to memory of 2396	4952	hkaqkpraruk.exe	83

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xhlucgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xhlucgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xhlucgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xhlucgp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xhlucgp.exe

C:\Users\Admin\AppData\Local\Temp\187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe
"C:\Users\Admin\AppData\Local\Temp\187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe
  "C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe" "c:\users\admin\appdata\local\temp\187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe
    "C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe" "-C:\Users\Admin\AppData\Local\Temp\wpculyqaskqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe
    "C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe" "-C:\Users\Admin\AppData\Local\Temp\wpculyqaskqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:2396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dxlewkdohahqmiitb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
56ef0882547002a0c21e5ee973c541b9

SHA1
e6ef58e113bc13df337ae42cdbc64544864fc00f

SHA256
7ed0a65e910f2b3341c501291ba4ab377a184fb2d037254b564525267cf4542f

SHA512
507e7ff7f56917ccb7cedc9b38df75f5c24c5624b224c8832f28c571bb8aefbed2c57487127cf31ba7861a42e3e6d9f1b7c9e49c000bb64f6f34054739ddc892

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
56ef0882547002a0c21e5ee973c541b9

SHA1
e6ef58e113bc13df337ae42cdbc64544864fc00f

SHA256
7ed0a65e910f2b3341c501291ba4ab377a184fb2d037254b564525267cf4542f

SHA512
507e7ff7f56917ccb7cedc9b38df75f5c24c5624b224c8832f28c571bb8aefbed2c57487127cf31ba7861a42e3e6d9f1b7c9e49c000bb64f6f34054739ddc892

Download Submit
C:\Users\Admin\AppData\Local\Temp\khyupgcqmisedcftewgd.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mhwqjyseysakhefraq.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpigdwukigsghindqkwvom.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wpculyqaskqytonx.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe

Filesize
704KB

MD5
357717aa49ff5c958fadebc66beef662

SHA1
cea3c1eb4dbb3a553aa5efd3705e70de1554ea31

SHA256
610ad5ff81d2f7fc320bb3699eab1b54420ee6d00772486b5294f06c5f8fbac3

SHA512
141881f1437ea3ea4c162f0f95a939a10d8b1e5b751ffb4ea4309e8931107640551679978ab3922a3b3317b3bb0fdb7f66873697bdbb06985b38edfd393b52ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe

Filesize
704KB

MD5
357717aa49ff5c958fadebc66beef662

SHA1
cea3c1eb4dbb3a553aa5efd3705e70de1554ea31

SHA256
610ad5ff81d2f7fc320bb3699eab1b54420ee6d00772486b5294f06c5f8fbac3

SHA512
141881f1437ea3ea4c162f0f95a939a10d8b1e5b751ffb4ea4309e8931107640551679978ab3922a3b3317b3bb0fdb7f66873697bdbb06985b38edfd393b52ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\xhlucgp.exe

Filesize
704KB

MD5
357717aa49ff5c958fadebc66beef662

SHA1
cea3c1eb4dbb3a553aa5efd3705e70de1554ea31

SHA256
610ad5ff81d2f7fc320bb3699eab1b54420ee6d00772486b5294f06c5f8fbac3

SHA512
141881f1437ea3ea4c162f0f95a939a10d8b1e5b751ffb4ea4309e8931107640551679978ab3922a3b3317b3bb0fdb7f66873697bdbb06985b38edfd393b52ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtjeyojwrmvgecerbsb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxpmiaxmjgreeeixjcnld.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\dxlewkdohahqmiitb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\khyupgcqmisedcftewgd.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\mhwqjyseysakhefraq.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\qpigdwukigsghindqkwvom.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\wpculyqaskqytonx.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\xtjeyojwrmvgecerbsb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\SysWOW64\zxpmiaxmjgreeeixjcnld.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\dxlewkdohahqmiitb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\dxlewkdohahqmiitb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\khyupgcqmisedcftewgd.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\khyupgcqmisedcftewgd.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\mhwqjyseysakhefraq.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\mhwqjyseysakhefraq.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\qpigdwukigsghindqkwvom.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\qpigdwukigsghindqkwvom.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\wpculyqaskqytonx.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\wpculyqaskqytonx.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\xtjeyojwrmvgecerbsb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\xtjeyojwrmvgecerbsb.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\zxpmiaxmjgreeeixjcnld.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit
C:\Windows\zxpmiaxmjgreeeixjcnld.exe

Filesize
1016KB

MD5
536bf34ae912efa69399ae0615e7f450

SHA1
3ba338a4be5324c58909fc7277c695c24a72f71b

SHA256
187e9921f03a46f2a3bd244a98983aeb564e78370471a0185625a2849949646b

SHA512
95b9fc3c338a69a59c95a612992206ab171aa57faf5f15d1bc99b4def276d1d1a6b11e163b6fbd7054b6dc00297098a3b8be3c86b1f63655a9beffdb600c612b

Download Submit